Jump to content
Piriform Community Forums

Augeas

Moderators
  • Content count

    4,079
  • Joined

  • Last visited

Everything posted by Augeas

  1. 1) Is this disk included in Windows' regular defrags? I don't know if usb connected devices are included but it's worth checking. Plus things I can't think of or don't know about. 2) I think that it's safe to say that a device withour power or means of access will be safe from modification, except by Martian death rays. If it is connected then it could be modified. I'm not saying that it will be, but nobody can say for sure that it won't. 3) More or less the same answer as 2. Not as far as I know. Maybe there is some error checking done or logs written somewhere. 4) A normal scan is very fast and reads the MFT, not the disk. A deep scan takes far longer and reads each unallocated cluster. It is advantageous if you can recover your files from a normal scan, they will be complete and up to date, one hopes. A deep scan does not retrieve file names or secondary extents, only selects a small range of file types, and does not differentiate between files days or years old. And takes ages to run. 5) A recovery - as long as you are recovering to a different device - should not harm the files nor degrade any future recovery attempts. It is a read process.
  2. can not identify file type

    Don't use any selection criteria, just search for everything and sort the results later.
  3. Ccleaner Portable

    No, I run Windows Defender.
  4. Ccleaner Portable

    I've run CC portable for years and it has never updated automatically. There is an option in Option?settings to be informed of updates, which is unchecked. There is also the option to accept silent background updates, which is greyed out and unselectable. It also has the CC Pro logo next to it, implying that silent updates are not available in CC free?
  5. MP4 files recovered but won't play

    There are difficulties in recovering very large files, very fragmented files, very old - and very new - files, and files on FAT32 devices. These are to do with the way the file system handles file deletion, not to do with Recuva (or any recovery software). Recuva will recover (i.e. copy) whatever is in the clusters pointed to by the addresses held in the file tables. In Recuva advanced mode have a look at the file header. Does it look valid (you can find out what a valid mp4/wmv file header looks like with Google)?
  6. Recovered files corrupted

    Plese post screenshots of Recuva, not your private documents, no matter how corrupted they are.
  7. First of all, we are talking about an HDD (not SSD), and it’s NTFS (not FAT32)? There’s been no change to Recuva’s recovery techniques well, forever, as far as I can tell. Also I don’t know of any Windows setting that would cause this. So I think it’s some other factor. If the files had been sent to the recycler then NTFS renames them to two components called $Innnn.ext and $Rnnnn.ext. Ignore the $I as they are indexes. Your videos may be recoverable under the $R names. Don’t put any search criteria when running Recuva. It won’t catch the above $R files for a start. Just search for everything, it won’t take any longer. I assume you’re running a normal scan. I wouldn’t run a deep scan yet. Have you run a wipe free space with wipe MFT? This will of course erase pretty much everything. Recuva will scan the MFT and show all file names for all records that are flagged as deleted, including the $I and $R files. These deleted records in the MFT will remain available until another file creation overwrites them. The greater the activity on the drive the more likely the names will be overwritten. Files created and deleted, as in your test, are most likely to have their MFT records reused quite quickly, as they used the first available record when they were created, and on deletion they become the first available record again. I’ll post again if I think of anything else. At the moment I would concentrate on the first two points, the $R names and the search criteria.
  8. what is black box testing

    Yes, he - or she - was warned in his last thread. He doesn't actually seem to spam anything but the questions are very childish.Perhaps he's never heard of Google.
  9. Wipe free space on SSD and HDD

    I don't agree with you Willy as - apart from the wear on the SSD - wiping free space cannot possibly achieve what it is trying to do as you cannot physically overwrite an SSD page. To the O/P, TRIM is an inbuilt function that tells the SSD that deleted pages are no longer required. If your SSD and PC/laptop are no more than say, five years old then TRIM should be available and enabled automatically. With TRIM there should be no deleted files in free space as the pages are emptied by the SSD controller. However TRIM is not infallible and occasionally some pages (deleted files) are left in an SSD's free space. To get rid of these you can run an Optimise from either Window's defragger or Piriform's Defraggler. This in effect runs a TRIM on the whole SSD and removes any deleted files there may be in free space. Mnay of your questions can be answered (far better) by Google or Wikipedia.
  10. Settings > Wipe Free Space drives

    Whenever you check the Wipe Free Space box in Cleaner/Advanced, and next run Cleaner, or if you r/click on Wipe Free Space in Cleaner/Advanced and select Clean Wipe Free Space.
  11. 35 Pass Wipe Took Up All Free Space

    You could download Recuva (portable) if you haven't alrready, in Advanced Mode Options/Actions check Scan for Non-Deleted Files (don't check Deep Scan) and run it. Then l/click on the State column header to sort the results, which will bring the Non deleted files to the top, and look if there are any unrecognised large files there. Or l/click on Size to order by size. If you find anything you can then delete them in Explorer, not Recuva.There are other ways of finding files on a disk, I'm sure.
  12. 35 Pass Wipe Took Up All Free Space

    You should have one or more files with long apparently random names in the root directory with a create date of the wipe. And of approx 400 gb in total. Delete them. Overwriting 35 times is, well, what can I say, rather excessive. That's writing about 18 terabytes of data to your drive when a single pass of 500 gb would have done just as well. The 35 pass overwrite is pointless, decades out of date and a waste of your time which you could spend mining for bitcoins, or some other ridiculous exercise the human race is prone to follow.
  13. Finding .ORF files

    If you have selected pictures as a scan filter then don't, clear any file type filters you have. I don't think that Recuva recognises .orf as a picture format. Is your laptop drive HDD, SSD, NTFS, FAT32?
  14. Analyze Report

    Well, you can right click and select Save to Text File.
  15. Cannot recover the files

    Why not attach a file in a format we can open?
  16. unable to reade recoverd excel data

    We can't open that file. Please post as a screen snapshot, with other information.
  17. As we don't know what the 'different overwriting program' was (and don't tell me, I will know nothing about it) we'll have to assume that the process was similar to CC's, i.e. that the file is edited to contain only zeroes then it is deleted. It's a bit of a misnomer, there is no such thing as secure deletion, it's an edit then delete. The MFT record for a file contains a header then a string of variable length attributes, beginning with $Standard Info, then $File Name. etc. Attribute $Data holds the addresses of each data fragment as a cluster start number and cluster count. If there are many fragments then the addresses can't all fit into the 1024 byte record, so a new MFT record is created containing just the $Data attribute, and the main MFT record points to that. (These cluster addresses are often held as negative little-endian, which is not to be trifled with, but I digress.) When a file with a large number of fragments (and multiple MFT records) is deleted then NTFS overwrites the cluster addresses in the extension records and overwrites the link to the extension records in the main MFT record. I've no idea why NTFS does this, it probably values MFT integrity over assistance in recovering deleted files. So you are left with an MFT record (which Recuva finds) with a file size of 1.2 gb in the $File Name attribute and no accessible data clusters. I have seen Recuva issuing the data not on disk message in similar cases. I haven't tried to overwrite one of these records but I would not be surprised if Recuva says that the data is resident in the record (which as sure as grass is green it isn't), as there are no data clusters to locate and overwrite. I am coming (OK, I'm already there) to the conclusion that your 1.2 gb file was in many fragments and the above scenario applied. It's not much to worry about (but why were you tryimg to recover a securely deleted file?). If the file had been normal deleted then a wipe free space would be required to overwrite it.
  18. The really foolish thing is that Analyse gives the results in the old 'advanced' mode, everything set out just as you want it. Then Run Cleaner switches to baby mode, so there is no immediate comparison to the analysis unless you faff around switching modes. There's no right click in baby mode either. I suppose I'll have to get used to it, but I'm not impressed with a picture of the Invisible Man and a coffee cup with a piece of paper in it.
  19. guillermo eiland California

    Perhaps a dictionary is the best place for the answer. I assume that English is not your first language, I'm pretty sure you're not Guillermo Eiland the actor, and I'm certain you don't come from California. Your posts here and on many other forums tend to be a little spammy, maybe some offline study would be a help.
  20. INFO Needed

    Options? If you had gone into Drive Wiper and opened the drop-down box you would have had the answer hours ago. The options are, in order of idiocy, 1, 3, 7 and 35 passes. I've no idea what HIPPA complaint (or compliance?) is. There is no compliance with anything with CC. It has no verification and no certification, so probably doesn't conform to any 'official' procedure.
  21. Best Work around

    Ultimately it is your choice.
  22. Best Work around

    If it's two months since deletopn, on the system drive, and there's a million images, I tink that there will be very little chance that you will recover a substantial amount of those images. And if you did then identifying and reinstating the others would be a horrendous task. I would reinatall.
  23. How to ignore deleted files?

    No, but if you run a normal scan (with select non-deleted files) and no deep scan the scan will be complete in a very short time. You will still get all the deleted files from the MFT, but you will have to manage this.
  24. Length of time for deep scan?

    Just to clarify, a deep scan runs a normal scan first so there will be files listed with file and folder names. Everything before the first [00001].ext file is from the normal scan. The normal scan takes info from the MFT. Each folder has an record in the MFT, that's the only place where they exist. Folders with a ? in the name mean that the record for the (deleted) folder has been reused, so the MFT record for the file is unable to chain back to the root.
  25. Length of time for deep scan?

    Well, that must be a relief. You have to be adnired for sticking at it. Files found with a deep scan (those with [01234].ext name) can't be ordered by folder structure as that info is held in the MFT, which the deep scan bypasses. Good luck with the sort.
×